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Deception in multi-attacker security game 
with nonfuzzy and fuzzy payoffs 
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Abstract 


There is significant interest in studying security games for defense op- 
timization and reducing the effects of attacks on various security systems 
involving vital infrastructures, financial systems, security, and urban safe- 
guarding centers. Game theory can be used as a mathematical tool to 
maximize the efficiency of limited security resources. In a game, players 
are smart, and it is natural for each player (defender or attacker) to try 
to deceive the opponent using various strategies in order to increase his 
payoff. Defenders can use deception as an effective means of enhancing 
security protection by giving incorrect information, hiding specific security 
resources, or using fake resources. However, despite the importance of de- 
ception in security issues, there is no considerable research on this field, 
and most of the works focus on deception in cyber environments. In this 
paper, a mixed-integer linear programming problem is proposed to allocate 
forces efficiently in a security game with multiple attackers using game the- 
ory analysis. The important subjects of information are their credibility 
and reliability. Especially when the defender uses deceptive defense forces, 
there are more ambiguity and uncertainty. Security game with Z-number 
payoffs is considered to apply both ambiguities in the payoffs and the reli- 
ability of earning these payoffs. Finally, the proposed method is illustrated 
by some numerical examples. 
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1 Introduction 


Game theory has many applications in real-world problems, in many fields 
such as economics, military, politics, and so on (e.g., see [6, 2, 37]). In real- 
world game problems, we may encounter various types of uncertainty or inac- 
curacy in information (payoffs). Many researchers have studied game theory 
with different types of information ambiguity [3, 38, 39]. Seikh, Dutta, and 
Li [36] studied matrix games with rough interval payoffs and investigated two 
different solution methodologies to solve such a game. Karmakar, Seikh, and 
Castillo [24] developed a matrix game in a type-2 intuitionistic fuzzy environ- 
ment. Bigdeli, Hassanpour, and Tayyebi [5] introduced two multiobjective 
linear programming problems to compute the optimistic and pessimistic val- 
ues of fuzzy multiobjective games and their corresponding Pareto optimal 
strategies for each of the players by considering the concept of nearest inter- 
val approximation. 

Security in maintaining military order and defense has always been a 
significant concern in human societies. In recent years, economic and political 
security has also become important. Limitations of resources such as money, 
personnel, and equipment have made it necessary to optimize the allocation 
of security resources. Security games have been successfully applied to solve 
many real-world security problems [1, 18, 26, 41]. They are also effective tools 
for arguing about the allocation of limited security resources and patrolling 
problems [1, 13, 25]. 

There has been a great deal of interest in research on game theory for 
security in airports, ports, transportation, and other infrastructures. Over 
the past decade, game theory has been used in various military sectors, com- 
puter network security applications, anti-ballistic missile defense systems, 
wildlife protection, and so on. Lye and Wing [27] proposed a game-theoretic 
method for analyzing security in computer networks. Brown et al. [8] de- 
scribed a new two-sided optimization model for planning the pre-positioning 
of defensive missile interceptors to counter an attacking threat. Conitzer and 
Sandholm [11] proposed a method to perform optimal random strategies in 
security games. Tarjom, Clempner, and Poznyak [42] used a method to cal- 
culate the Nash equilibrium in the case of one defender and several attackers. 
With respect to wildlife protection, Fang et al. [18] used repetitive interac- 
tions between rangers and hunters in protected areas to plan a patrol strategy 
that allowed rangers to collect hunting signals over time. Bigdeli, Hassan- 
pour, and Tayyebi [7] proposed a model for solving a multiobjective security 
game with fuzzy payoffs and its application in a metro security system. 
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Most security games use the Stackelberg game because security forces 
typically commit to specific security policies to arrange their forces. Thus 
attackers are empowered to model their attacks under surveillance to take 
advantage of any potential weakness of the defender. Furthermore, the main 
assumption in Stackelberg security games is that limited security resources 
must be deployed strategically, considering differences in priorities of targets 
requiring security coverage and the responses of the adversaries to the security 
position (e.g., see [7, 4, 42, 43, 44]). 


Previous studies assume the perfect surveillance of the defender’s strate- 
gies despite the deceptions, while it is natural that if one of the players can 
deceive another, he will not hesitate. Defender’s deceptive actions can affect 
the attacker’s view of the defender’s strategy, thus on the attacker’s best 
response, and vice versa. Despite being relatively ignored in academia, in 
the military, deception is as old as war or politics. There are many examples 
of military deception in history. The story of the Trojan horse in Ancient 
Greece is perhaps the most famous ancient military deception. Also, in an- 
cient China, many generals used to resort to deception ruses [30]. 


As a more recent example, World War II armies deceived their enemies by 
designing and building air tanks and wooden artillery. Thus, enemy forces 
would overestimate the enemy’s defense capabilities and waste their ammuni- 
tion or endanger their equipment. In another example, on a Japanese island 
in the Pacific Ocean, wicker planes deceived many American pilots. They 
spent a significant portion of their ammunition attacking unreal models by 
thinking only that the planes were real. For further study, in [12, 21, 19], 
there are numerous examples of deception in the First and Second World 
Wars. 


Although research on deception in security games has increased in recent 
years, there is no noteworthy research in this field. Moreover, most authors fo- 
cus on deception in cyber environments (e.g., see [14, 20, 28, 32, 40, 47]). Re- 
cently, deceptive methods have also been used to defend information systems. 
Cohen and Koike [10] provided a comprehensive discussion of deception to 
increase the security of information systems and concluded that “deception” 
is a positive factor for the defender and a negative factor for the attacker. 
In the security-military sector, Yin et al. [45] examined how fake resources 
and concealing the real resources of the defender might affect the attacker’s 
beliefs and thus affect his best response. The authors [17] proposed a mathe- 
matical model to solve a security game in a fuzzy environment, in which the 
defender uses unrealistic resources when confronted with only one attacker. 
In the real world, it is important for players to have complete confidence in 
their information. Especially in situations where the defender uses deceptive 
defense forces, there are more ambiguity and uncertainty. Therefore, not 
only players can not accurately estimate their payoffs, but also they cannot 
be 100 % sure of these approximated estimates. Therefore, using fuzzy set 
theory in such games is necessary. There is no research on multi-attacker 
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security games with deceptive resources and fuzzy payoffs based on the best 
knowledge of the authors. 


The security game has also been studied in [7, 17, 41]. In the multi- 
attacker security game solved in [41], the players’ payoffs are considered to 
be crisp numbers. In [17], a security game problem in the fuzzy environment 
having only one attacker was solved. The fuzzy order used in [17] increases 
the number of constraints. In addition, the proposed method cannot be gen- 
eralized to the case of multiple attackers. In [7], a multi-attacker security 
game with triangular fuzzy payoffs was solved, in which the authors consid- 
ered the pessimistic situation and obtained an efficient solution for a cautious 
defender. In this paper, a security game problem with different types of at- 
tackers and different types of defense forces, such as real, secret, and fake, in 
a fuzzy environment is considered. 


The remainder of the paper is organized as follows: In Section 2, some 
required concepts of fuzzy set theory are given. In Section 3, Stackelberg 
games are introduced, and the concept of efficient strategy in these games 
with multi-follower is defined. A security game with different types of at- 
tackers is introduced in Section 4. In Section 5, a security game problem is 
considered in which the defender’s strategies can include deceptive protection 
covers, and a multiobjective optimization problem is proposed to obtain an 
efficient strategy for the defender. In Section 6, the players’ payoffs are con- 
sidered as Z-numbers, and a multiobjective optimization problem is proposed 
to get the efficient coverage of the defender when he uses deceptive resources. 
In Section 7, four numerical examples are provided to illustrate the proposed 
method. Finally, the conclusion is made in Section 8. 


2 Basic concepts and definitions 
In this Section, some concepts that are used in the paper are given. 


Definition 1. A fuzzy set A defined on a universe X is given as A= 
{(x, wy(a))|c¢ € X}, where pz : X —> [0,1] is the continuous member- 
ship function of A. The membership value pu 4(®) describes the degree of 
belongingness of x € X in A. 


The support of a fuzzy set A on X is defined by 


supp(A) = {x € X | w4(x) > Of. 


A fuzzy number is a fuzzy set A on the real line R with a continuous 
membership function jz that can be described as follows [15, 22]: 
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0 for all 2 € (—oo, ay], 
fa(x) — for all x € [ai, ag], 
py(z)=4¢ 1 for all x € [ag, as], (1) 
ga(x) for all x € [a3, ay], 
0 for all x € [a4,00), 


where f4 represents a continuous and monotonically increasing function on 
[a1,@2] and gq is a continuous and monotonically decreasing function on 
[a3, aa]. 7 7 
The a-level set of a fuzzy number A is defined by the ordinary set Aq = 
{x € X| q(x) > a} for a € (0,1), and fora = 0, Ay = cl{xz € X| q(x) > 0} 
where cl means closure of the set [9]. For a € (0, 1], the a-level set of a fuzzy 
number is a closed and bounded interval, denoted as Ag = [f4'(a), 9,4" (a)], 
where fz (a) =inf{x| w4(x) > a} and g4'(a) = sup{2| a(x) > a}. 


Definition 2. [22] The expected interval of a fuzzy number A, denoted by 


EI(A), is defined as follows: 


EI(A) =[ | fa'(a)da, | 94°(a)dal. 


A fuzzy number A on R is said to be a triangular fuzzy number if its 
membership function pz : R —+ [0,1] is 


(x — a) /(a? — a’), a <e <a", 
walt) = 4 (@ —2)/( — 0%), @ <a K<a’, 2) 
0, otherwise, 


where a! and a? represent the beginning and end points of the support of A, 
respectively, and a? is the median value (center). 

The triangular fuzzy number defined above, is denoted by A = (a', a”, a°). 
The addition of two triangular fuzzy numbers A = (a!,a?,a) and B = 
(b!, b?, b°), and the multiplication of the triangular fuzzy number A by k € R 


using the extension principle of Zadeh [34] are obtained as follows: 


A+B = (a', a’, a9) + (b1, 67, b°) = (a +b, 0? + b7,07 +57). (3) 


~ _ | (ka', ka?, ka®), k>0, 
et a k<0. (4) 


Proposition 1. [31] If A is a triangular fuzzy number, then its expected 
interval can be computed as follows: 


~ 1 1 
BI(A) = [5(a! +02), 5 (a? +0), 
Let A = [A”, A®] and B = [B", B®] be two intervals. Then, 
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A+B =|A’+ B* A" + A") A- B= [AY —R* AP BY, 5) 


_ f [AA?,rA*), A> 0, 
MA { [AAR XA]. <O, (6) 


where is a real scalar. 

Traditional fuzzy sets were developed to model the uncertainty made by 
human doubt when extracting information. However, the classical fuzzy sets 
do not account for the reliability of the obtained information. To overcome 
this limitation, Zadeh [46] proposed Z-numbers. 


Definition 3. [23] A Z-number is an ordered pair of fuzzy numbers denoted 
as Z = (A,R). The first component A is a restriction on the values which 
a real-valued uncertain variable Y can take. The second component R is a 
measure of reliability for the first component. 


In above definition, the membership function of the first component A, is 
iq : X — [0,1], where X is an arbitrary universal set and the membership 
function of the second component is yp : [0,1] — [0,1]. 

In this paper, both parts of Z-numbers are considered to be triangular 
fuzzy numbers. To manipulate the problem involving Z-numbers, first, we 
convert Z-numbers to triangular fuzzy numbers in three steps, using the 
method presented by Kang et al. [23]. Consider a Z-number Z = (A, R). 

Step 1. Convert the second component to a crisp number a as follows: 


(7) 


Step 2. Use a as the weight of the first part (restriction). The weighted 
Z-number can be denoted as Z* = {(a, 3a(X))|Mga(x) = ap g(x), 2 © X}. 
Step 3. Convert the irregular fuzzy number (weighted restriction) to regular 
fuzzy number. The regular fuzzy set can be denoted as 

x 


Z' = {(a, yg,(x))|mg (x) = wg l at € VOX}. 


Example 1. For the triangular fuzzy number A = (a!, a?, a®) by some simple 


calculations, one can see from (7) that 


at +a? +a? 
3 . 


a 


Let we have an uncertain variable, which takes the value of “almost 3” with 
the reliability of “almost 0.9”. One can represents “almost 3” by the trian- 
gular fuzzy number (2, 3,4) (e.g.), and its reliability by the triangular fuzzy 
number (0.8,0.9,1). Then we have the Z-number Z = ((2,3, 4), (0.8, 0.9, 1)) 
to represent such an uncertainty. To handle such a Z-number payoff in our 
game problem, first we convert its reliability to a crisp number as follows: 
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14 421 43 
a= a a ee 0.9. 
3 
Then, we convert the weighted Z-number to triangular fuzzy number accord- 


ing to the proposed approach. So we have 


Z' = (2V0.9,3V0.9,4V0.9) = (1.8974, 2.8461, 3.7948). 


3 Stackelberg game 


Stackelberg games, also known as the leader-follower games, were first intro- 
duced in 1952 by the German economist Van Stackelberg to model leadership 
and commitment. In Stackelberg games, the first player is the leader who 
chooses a strategy first, then the second player, called the follower, observes 
the leader’s strategy and selects a counter-strategy accordingly. In other 
words, the game has two players and two stages. In stage 1, the leader’s 
action set is [0,00), whereas the follower’s only available action is to “do 
nothing”. In stage 2, the follower’s action set is [0,0co), and the leader’s only 
available action is to “do nothing”. The problem in this game is to find the 
optimal strategy for the leader, assuming that the follower optimizes his pay- 
off according to the logical observations that depend on the chosen strategy 
of the leader. The leader is committed to his decision, which means that if he 
selects a strategy, then he cannot change it. Therefore, to obtain Stackler- 
berg’s solution, first, the maximum value of the follower’s payoff is obtained 
for the various strategies of the leader. The payoff of the leader is optimized 
on the best response of the follower. The solution from the above process 
is called the Stackelberg solution, which can be calculated by the following 
bilevel linear programming problem[29]: 


max 21(%,y)=axet+diy 
x 


where y solves 


max 29(2,y) = cox + doy 
y 


subject to Ar + By < 8, 
c20, y20, (8) 


where c, and c2 are n-dimensional row coefficient vectors, d, and dz are n2- 
dimensional row coefficient vectors, A is an m x71, B is an m Xx n2 coefficient 
matrix, and b is an m-dimensional column constant vector. Moreover, 21 (2, y) 
and z(x,y), respectively, represent the payoff functions of the leader and 
follower, and x and y represent the strategy of the leader and the follower, 
respectively. 

If the leader commits to the strategy x, the optimal solution y*(x) is ob- 
tained as the logical solution of the follower, by solving the low-level problem 
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of (8). Assuming that the follower gives a logical solution y*(x), the leader 
maximizes his objective function z(z,y*(x)). In this case, the obtained so- 
lution is called the Stackelberg solution. This problem can be solved us- 
ing bilevel programming method (see, e.g., [29]). In this paper, we use the 
Karush—Kuhn—Tucker (KKT) optimality conditions. 

In a Stackelberg game with multi-followers, the leader has to maximize 
his payoff in the face of several types of followers. He has to choose a strategy 
to get the most payoff against all of the followers. 

First, the followers choose their strategies, so each of them plays his best 
response. The leader must decide how to play against all of them in order 
to earn the highest possible payoff. He cannot play his best response against 
all the followers. Because if he plays his best against one of the followers, 
he may suffer a significant loss against another, which will reduce his final 
payoff. Therefore, to obtain Stacklerberg’s solution, a multiobjective prob- 
lem must be solved. Let us call this solution an efficient strategy, defined 
mathematically here. 


Definition 4. Consider a Stackelberg game with p followers. Suppose that 
y is the chosen strategy of the follower type j and that 2/ is the chosen 
strategy of the leader against the follower j. Let Uj(a!,y’) and U}(x7,y’) 
be the payoffs of leader and follower type j, respectively, for the selected 
strategies. We call the strategy «* = (x!*,x?*,...,2*) the efficient strategy 
for leader, whenever (x*, y*) is an efficient solution of the following multiob- 
jective programming problem 


iey)= max(Uj (x", y'*),..-,UP(a?, y?*)), 


where 3/* represents the best response of the follower type j to the leader’s 
x strategy. 


4 Security game with multi-attackers 


The security game precisely matches the Stackelberg game if we consider 
the defender as the leader and the attacker(s) as the follower(s). Thus, in 
this game, the defender commits to a strategy first. Then, the attackers 
optimize their payoffs, considering the action chosed by the defender. The 
defender must first commit to a strategy for placing his resources (manpower, 
equipment, ammunition, etc.) on targets. Then the attackers decide which 
targets they attack. 

Let T = {1,...,n} be a set of targets, which may be attacked by p 
attackers, and assume that the defender has m security forces to protect 
the targets. The defender and each of the attackers, as the players of this 
game, try to earn the most payoffs. The attackers select targets that cause 
the most damage to the defender. On the other hand, the defender aims 


IJNAO, Vol. 12, No. 3 (Special Issue), 2022, pp 542-566 


550 Esmaeeli, Hassanpour and Bigdeli 


to optimize resource assignments to minimize damage. Thus, each player 
has different strategies for achieving his goal. Each pure strategy of each 
attacker is to select a target to attack. The mixed strategy of attacker type 
j is Ai = (ai,...,a/,), defined as follows: 


n 
af >0, forallteT, Soa =1, j=1,...p 
t=1 
where a! is the portion of the force of attacker type j used in attacking to 
the target t. 


Each pure strategy of the defender is choosing a set of targets that have 
to be protected. If the defender considers only pure strategies, some targets 
may not be covered, and the attackers may use this weakness to attack them. 
Note that security resources are limited, and the defender may not be able 
to cover all the targets fully. Given the limited resources, we define the 
defender’s mixed strategy as C = (c1,...,Cn,), where 


O<e@<1, foralteT, Soa<m. 
t=1 


In fact, c, is the amount of coverage of the target t € T and indicates the 
probability of the defender succeeding in preventing an attack on the target 
t. The constraint 0 < c < 1 ensures that the amount of coverage of the 
target t have to be less than or equal to one unit of force required for the 
target t and to prevent force loss. The constraint Saas cy < m ensures that 
all of the allocated covers have not to be more than the number of available 
covering forces. 


Suppose that defender and the attacker type j choose strategies C’ and 
AJ, respectively. The expected payoffs of the defender and the attacker type 
j, are 


Us(C, A’) = Yalvie.», j=l,...,p, 
Us(C, A’) = alten, j= 1,..5p, (9) 


if the target t is attacked by a! unit of the force of attacker type j and covered 
by cover cz, where 


UI(C,t) = qUG) (t) + (1 - UL), 
UA(C,t) = qUS4(t) + (1— ee )UZI (A). (10) 
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In (10), US" (t) (Ui (t)) is defender’s payoff when the target t is selected by 
attacker type j and covered (uncovered) by the defender. Similarly, US (t) 
and U4 (t) are defined for the attacker type j. 

This security game, as a Stackelberg game, has several followers (attack- 
ers), wherein the defender first selects a strategy, and the attackers surveil 
the defender’s actions. Each attacker tries to maximize his payoff by choosing 
a strategy that is the best response to the defender’s fixed strategy. This is 
while the defender has to maximize his payoff against several types of attack- 
ers. He has to decide how to cover the various targets to get the most payoff. 
In other words, we are looking for an efficient strategy for the defender. The 
defender has to consider the set of best responses of attackers to each of his 
strategies. 

An efficient strategy is obtained by solving the following bilevel multiob- 
jective program: 


(P,) Max (Uz (C, A’), UZ (C, A?),..., U2 (C, AP)) 


s.t. boaay ce <m™, 
O<e@<1, t=1,...,n, 
where AJ solves 
Max UI(C, A?) |. 
s.t. ye, af =1, eas EL) 


a! > 0, GS-1, 1 


where U3(C, A‘) and Ui(C, A’) for j =1,...,p are given by (9). 


Theorem 1. The bilevel multiobjective program (P,) can be solved by solv- 
ing the following multiobjective optimization problem: 


(Po). Maz (lg(CyA UPC, A \ 02.305 (C, A? )) 


s.t. ys <m, (11) 
t=1 
Wee, PST i: (12) 
aj > 0, 
i & Meo 
a S Moe, gH l,... 5D, 
Dre % = 1, t=1 n 


0< kh — (4US4(t) + (1 — o)UY4(t)) < (1-62) M, “% 
ki ER, 6} € {0,1}, 
(13) 


where M is a large positive number, and Uj(C, A!), U7(C, A),..., U2 (C, A”) 
are given by (9). 


Proof. We prove that the constraints (13) are equivalent to the low-level 
problem of (P;). By keeping C’, the optimal policy of the defender fixed, the 
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optimization problem of attacker type 7, which gives his best response to the 
defender’s strategy C, is 


Maz Uj(C, A’) 


st. YG =1, (14) 
aj >0, t=1,...,n, 


There is a scalar k’ that satisfies together with a} the following KKT op- 
timality conditions (Note that keeping C fixed, each low-level problem is a 
linear programming problem, for which the KKT conditions are necessary 
and sufficient for optimality): 


ki > ¢ USF (t) + (1 —e)UY (0), a” es 
at (ki — (eo UPI) + (L-a@)UPF())) =0, t= 1,...,, 


t=1 
al>0, t=1,...,n 

(15) 

By introducing the binary variables &f for t = 1,...,n, and M as a large 


positive number, the constraints (15) are equivalently written as follows: 


a<MiS, t=1,...,n, 
0 < i _ (cUS4 (t) + (1 -_ cr) Uz (t)) < (1 — 5})M, t= 1,. 1457, 


n 
ay = 1, 
t=1 


al > 0, t=1,...,n. 
(16) 


If the defender knows that each attacker attacks at most one target, the 
constraints (13) can be equivalently replaced by the following constraints: 


J 
ay € {0, 1}, : 
n = ee ’ 
Dee = 1, | | oe! ay 
0 <b — (US (t) + (1 — UP (é)) < (1 — a) M, 


A solution to the multiobjective programming problem (P2) is an efficient 
strategy for the defender in the security game with multiple attackers. 

There are several methods to get an efficient solution to problem (P2) (e.g., 
see [16, 34]). In Section 7, we use the weighted sum method. The weights 
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of the objective functions in problem (P2), depending on the importance of 
them for the defender, can be determined by consultation with experts or 
using methods such as AHP! and TOPSIS?. 


5 Deception in multi-attacker security game 


In a security game, depending on the available budget, a defender can use 
deceptive resources to increase his payoff or to reduce the attackers’ desire to 
attack targets. For example, in military operations, the security of various 
urban or regional centers, different political ceremonies, and so on, defense 
forces use some types of covert resources and some types of fake ones. De- 
pending on the type of protected targets, the defender uses different deceptive 
resources, with different probability of deception failure. For example, hidden 
cameras for protected targets, secret police forces, air marshals on the flight 
lines, and fake resources are some deceptive resources. The defense force must 
be able to have the best arrangement of these resources against the attackers 
according to the available budget. In this section, we consider m real forces 
and two kinds of deceptive resources: the first kind has a positive effect on 
the defender’s payoff. For example, secret forces have positive effects on the 
defender’s payoff because they have defensive power. The second kind has 
no effect on the defender’s payoff and only reduces the attackers’ desire to 
attack targets. These kinds of deceptive resources do not affect the defense 
of a target, but they can at least disturb the view of the attackers, and they 
can reduce the intensity of their attacks. For example, fake resources cause 
errors in the attacker’s observations but do not have defensive power. There- 
fore they do not increase the defender’s payoff. We denote the set of the first 
(second) kind of deceptive resources by D, (D2). Accordingly, the defender’s 
payoff for a target t € T is 


U4(C,t) = UG" (t) + (1— UG (t) + SS (ce UP" (f) + (1 - UG” (2). 
i€D1 

(18) 
In (18), for i € D, and t € T, ce; is the amount of deceptive resource cov- 
erage, and U%"!(t) (U#"/(t)) is the defender’s payoff from deceptive resource 
coverage (uncoverage) i against the attacker type j. Note that, obviously, the 
defender’s payoff from using a deceptive resource i € D, and a real resource 
are not the same necessarily. Also, obviously c; + are D, Cti 1 because 
more coverage for the target t is useless for the defender. If the importance 
of a real cover unit differs from a deceptive cover unit, then the mentioned 
constraint is changed to we + oie p, Wit, < 1, where w and w; are the 


weights of real cover and each unit cover type 7, respectively. 


1 Analytic Hierarchy Process 
2 Technique for Order of Preference by Similarity to Ideal Solution 
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To determine the attackers’ payoffs, we look at the amount of coverage 
that they observe and their reaction. Using deceptive coverage resources by 
the defender is not always 100 percent successful in deceiving the attackers. 
It is natural that each of them has a failure probability. Suppose that r; is 
the probability of deceptive resource’s failure for 1 € Dy U Do. If the vector 


of defender choices is C = (¢1 + oie Dud, Cliir+ ++ Cn + Die DUD» Cn,i), then 
the attacker’s observation is FE = (e1,...,@€n) in which 
ep =e t+ S- TiCt,i b= bye cen. (19) 
1€D,UD2 


It is assumed that the failure probability of the deceptive resource depends 
only on its structure. Therefore, the failure probability of one type of decep- 
tive resource is the same for all attackers. Then the payoff of attacker type 
j is 


UZ(E, t) =eeU g(t) + (1 — ce) US) (20) 
+ a (rye, ,U4 (t) + (1 — ri) (1 — ce )U2 (8), — Lye ye 
t€D,UD2 


In (20), US (t) (UM (t)) is the payoff of attacker type j in attacking to 
the target ¢ with (without any) deceptive resource coverage i. 


Now, suppose that the defender’s budget to create deceptive resources is 
B, and that he can purchase deceptive resource type 7 at the cost of B; per 
unit. Then to obtain an efficient defense strategy, he has to consider the 


following constraints: 
s S- Bien < B. (21) 
t=1 i€D\UD2 


Based on the above discussion, the efficient strategy of the defender is ob- 
tained by solving the following multiobjective mixed-integer linear program: 


(P3) Max (Uj(C, A"), UZ(C, A?),...,U3(C, A?)) 
S.t. paar ca < mM, 
0<q@<1 tS Leases 
crt Mien, ci S1, tH 1h 
as Died uD, Bice, < B, 


vie & = 1, 
a, > 0, pa ' 
a} < Méi, See 


0< ki —UI(B,t)) < (1-87) M, 
ki ER, & € {0,1}, 


where M is a large positive number. 
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6 Deception in multi-attacker security game in a fuzzy 
environment 


In the real world, the information in a security game is often vague due to 
the lack of sufficient evidence. For example, a defender may not accurately 
identify any type of attacker, and attackers may not recognize and/or control 
different kinds of deceptive resources. Even if they know to some extent what 
the deceptive resource is, they cannot be 100% sure of what they have seen. 
In this situation, showing the payofts in the form of Z-numbers is an appropri- 
ate suggestion for expressing ambiguity. The first component represents the 
player’s payoff from selecting a strategy, and the second component shows 
the measure of the reliability of this selection. In our study, both components 
of Z-numbers are considered to be triangular fuzzy numbers. For a strategy 
profile (C, A), the payoff of attacker type j is U2. = (U2, Ri), wherein Ui 
and Ri represent the payoff of attacker type j and the reliability of earning 
this payoff, respectively. The same definition is applied to the defender, and 
his payoff against attacker type j is denoted by U%, = (U; ie Hy, To solve the 
problem, we convert the Z-numbers to triangular fuzzy numbers by the pro- 
cedure described in Section 2. Finally, considering the described conversion, 
we have a triangular fuzzy number for each player’s payoff. 

Now we have the following programming problem, in which some param- 
eters are triangular fuzzy numbers: 


(Pi) Max  (U}(C, A*), U2(C, A”), ...,U2(C, A?)) 


n 


S.t. com, 
t=1 
0<¢ <1, t=1,...,n, 
at >> ee <1, t=1,...,n, 
i€D, 


n 


S- S- Biegs < B, 

t=1 i€D,UD2 

Vie G _ 1 

O< a < Mé, =| 

US (E,t) < k, Do Ae ae 
ki < (1-8&)M + 03(E,2), 
ki ER, 6 € {0,1}, 


To solve the problem (P4), let for s = a,dand j = 1,...,p, EI(U3(C, At)) = 
[Ui"(C, A’), UJ? (C, A?)] and EI(k) = [k!”,k/"] be the expected intervals 


corresponding to fuzzy numbers Uj(C, A’) and k, which are calculated ac- 
cording to Proposition 1. Then problem (P,) is transformed into the following 
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(Ps) Max ([Uz"(C, A‘), UZ*(C, A’)],...,[U2"(C, A”), UR *(C, A?)]) 

S.t. 
Pe Ct < Mm, 
O0<q <1, er 
Gt > 2p, Ges GL t 1-- nN, 
ae viED UD2 Bice < B, 

11% = 1, j=l,. “oD; 

j j jJ=l,...,p, 

eee t=1,...,n, 
[Ui"(E, t)), UZR(E, t))] < [k", kIF), te 
(RE, wR] < (1 — 62M, Mi] + UH(B,8), UB), 1 2 
KE kU ER, 6 € {0,1}, j=l,...,p. 


There are several methods for solving (Ps). In most of them, the main 
idea is based on intervals’ comparison. Instead, Saati, Memariani, and Ja- 
hanshahloo [33] proposed a new approach in which a variable is defined cor- 
responding to each interval so that it maximizes the objective functions while 
satisfying the constraints. More clearly, to solve problem (Ps), we solve the 


following problem: 


(Ps) Maz (u1,..., Up) 
Bet > ar te SO 


0<¢ <1, il een ce 
G+ Sep, Ga SA $= 1e sang; 
=I i€ D1 UD2 Bic S B, 
UIK(C, AI) <uj <UIR(C,A)), f= 1. s, 
Ugh (E,t)) < v; < UZ*(E,t)), GHl,.--5D, 
ak, j=l,...,p 
4 at — 1, 
OS a < Mb, J=Hl,...,D, 
U5; < k;, 
4 i= 1, yn, 
k; < (1— 6:)M +4;, 
kit kU ER, 62 € {0,1}, 
in which ; 
Uj € CAG A) Ue, A?))], os 1s “+d; 
vj € (U2"(E, t)), UZ*(E,t))], j=l1,.--sD, 
ky € [k?", k7], ty eer 
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In fact, by solving problem (P¢), the best choices of the variables u;, vj, and 
k,; are determined from their corresponding intervals so that both maximize 
the objective functions and satisfy the constraints. 

Now, once again, we have a multiobjective problem with crisp parameters. 
There are several methods to get an efficient solution to this problem (e.g., 
see [16, 34]). In the solved examples in Section 7, we use the weighted sum 
method. 


Remark 1. The proposed method was extended to solve a multi-attacker 
security game having Z-numbers payoffs. However, it can be used if the 
payoffs are triangular fuzzy numbers or real numbers as well. In the first 
case, steps 1-3 in Section 2 to convert Z-numbers to triangular fuzzy numbers 
are removed, and in the second case, we have to solve the problem (P3). 


Remark 2 (Comparison with similar works). As mentioned in Remark 1, 
our method can also be used to solve a security game with triangular fuzzy 
payoffs. Such a problem was also considered in [7]. Bigdeli, Hassanpour, and 
Tayyebi [7] have used a pessimistic approach to solve the problem, but our 
method solves the problem without considering a pessimistic or optimistic 
point of view. Therefore it is natural to obtain different solutions by the 
two methods. Furthermore, there is no significant difference between the 
two methods in view of computational complexity. Therefore, in a security 
game with triangular fuzzy payoffs, a pessimistic decision-maker can use the 
method of [7]. The special feature of our work is that we have considered a 
security game with Z-numbers payoffs and deceptive resources, but in [7], it 
did not cover these issues. 


7 Numerical examples 


In this section, we give four examples. In the first example, the defender uses 
only real resources. In the second example, the defender uses three types 
of deceptive resources: one fake and two types of secret resources. In both 
examples, the players’ payoffs are considered to be real numbers. In the third 
example, the defender uses two types of deceptive resources, and the players’ 
payoffs are Z-numbers. The final example is an example solved in [7]. We 
solve it by our method and compare the solutions obtained from the two 
methods. All of the optimization problems in examples were solved by Lingo 
software. 


Example 2. In a security game, suppose that three attackers intend to 
attack four targets and that a defender has m = 2 forces to protect these 
targets. The players’ payoffs are given in Tables 2-4. The weights assigned 
to the tables are 0.2, 0.3, and 0.5, respectively. 

By solving the problem (P:) by the weighted sum method, the following 
efficient strategy is obtained: 
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Table 1: Game matrix of defender and attacker type 1 in Example 2 


target 1 target 2 | target 3 | target 4 

covered (c) uncovered (u) | cu cou cow 

defender | 1.5 -0.5 5 -6 | 2 -1)]9 = -8 
attacker | -1.5 2 4 5 | -2 4 9 


Table 2: Game matrix of defender and attacker type 2 in Example 2 


target 1 target 2 target 3 target 4 
ct c UW c UU c wu 
defender | 2 -0.5]/ 6 -5 | 3 -2 | 11 -10 
attacker | -1 1 3 4 |-2 3 | -4 8 


C = (0.34, 0.55, 0.40, 0.62). 


Since the defender has two covering resources (two defense forces), it is con- 
cluded that 17, 27.5, 20, and 31 percent of the forces should be assigned to 
the targets t,, to, t3, and t4, respectively, and 4.5 % of defense forces are not 
assigned. 

As the tables show, the target t4 has greater payoffs for the defender than 
the other targets. Also, for all three attackers, this target has greater payoffs 
than the other targets. Therefore, it is more likely to attack this target. In 
the case of the target t; is the opposite. In the solution obtained by our 
method, the highest coverage was obtained for the target t4, and the lowest 
coverage was achieved for the target ty. 


Example 3. Consider a security game in which three attackers intend to 
attack four targets. The defender has m = 1 real security force to protect the 
targets. Decision-makers (experts) have provided the following information: 
The defender uses three types of deceptive resources. He uses an experienced 
and trained secret force with a 0.2 probability of being exposed. At the same 
time, a real force acts as a covert force with a lower cost and 0.4 probability 
of being exposed (secret normal force). The payoff of an experienced secret 
force is 1.3 times more than that of a real security force. The probability that 
the attacker will not distinguish these fake resources is 0.4 (i.e., his failure 
probability is 0.6). The required budget for each deceptive force unit is 1, 


Table 3: Game matrix of defender and attacker type 3 in Example 2 


target 1 | target 2 | target 3 | target 4 
cou cou cc U Ce Ut 
defender | 1 -0.5 | 6 -45] 3 -1 | 10 -9 
attacker |-1 0.5 | -4 5 -3 4 | -6 10 
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Table 4: Game matrix of defender and attacker type 1 in Example 3 


cover’s type target 1 | target 2 | target 3 | target 4 
c UU Ee wt cou c ou 
defender real 5 -3 | 8 -9 | 2 -2.5 } 3 -5 


real/secret normal force | -2 3 | -4 6 /-3 5 | -4 5 
attacker | experienced secret force | -3 3 | -5 6 | -4 5 5 5 
fake 3 -3 | 6 -6 | 5 -5 3. -5 


Table 5: Game matrix of defender and attacker type 2 in Example 3 


cover’s type target 1 target 2 | target 3 | target 4 
cw cc U cu cu 
defender real 4 -1 10-7 {15 -1 }) 2. -2.5 
real/secret normal force | -3 2.5 | -2 15 | -2) 1 | -3 1 
attacker | experienced secret force | -4 2.5 | -3 1.5 | -2 1 | -l 1 
fake 2.5 -2.5 )1.5 -15] 1 1} 2  -1 
3, and 7, respectively, for fake, secret normal, and experienced secret force, 


and the defender’s available budget is 12. The players’ payoffs are given in 
Tables 4-6. 

Solving the problem (P3) by weighted sum method with equal weights for 
the objective functions yields the solution given in Table 3. 

This means that in order to protect four targets with the mentioned se- 
curity resources, the defender must plan the presence of the real security 
resource with 42% in the target 1, 50% in the target 3, and 7% in the target 
4. The target 2 does not require a real resource, and it is sufficient to be 
protected by an experienced secret force unit and 0.79 fake force unit. Like- 
wise, the defender must deploy other deceptive security resources according 
to Table 3. 


Example 4. Consider a security game with three targets and two attackers. 
The defender uses m = 1 real security force and two secret sources to protect 
the targets. Secret forces are exposed to 0.3 probability. The required budget 
for a secret force unit is 5, and the defender’s available budget is 9. The value 
of each unit of secret force is 1.5 times that of a real force unit. The players’ 
payoffs are Z-numbers given in Tables 8 and 9. 


Table 6: Game matrix of defender and attacker type 3 in Example 3 


cover’s target 1 | target 2 | target 3 | target 4 
type c U c U c U c U 
defender real 5 -2|6 -4 } 3 -1 | 4 -3 


real/secret normal force | -3 3 |-2 5 |-2 4 /-1 1 
attacker | experienced secret force | -3 3 |-2 5 |-2 4 |-1 1.5 
fake 3 -3 | 5 -4 | 4 -5 | 1) -2 
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Table 7: Amounts of targets coverages in Example 3 


i=real | i=experienced secret force | i= secret normal force | i= fake 
t=1 0.42 0 0 0 
t=2 0 1 0 0.79 
t=3 0.5 0 0.5 0.2 
t=4 | 0.07 0 0.5 0 


Table 8: Game matrix of defender and attacker type 1 in Example 4 


defender attacker type 1 
real ((6,6,7), ((-3,-2,-2), ((-3,-3,-2), ((2,3,4), 
ty (0.8,.0.9,1)) (0.8,.0.9,1)) (0.8,.0.9,1))  (0.7,0.8,.0.9)) 
secret ((3,3,4), ((-2,-2,-1), ((-4,-3,-2), ((1,2,3), 
(0.6,0.7,0.8))  (0.6,0.7,0.8)) | ,(0.6,0.7,0.8))  (0.6,0.7,0.8)) 
real ((6,6,7), ((-2,-1.5,-1), ((-5,-4,-3), ((2,3,3), 
to (0.7,0.8,0.9)) — ,(0.7,0.8,0.9)) | (0.7,0.8,0.9))  (0.7,0.8,0.9)) 
secret ((3,4,5), ((-2,-1,-1), ((-2,-2-1), ((1,2,3), 
(0.6,0.7,0.8))  (0.6,0.7,0.8)) | (0.6,0.7,0.8))  (0.6,0.7,0.8)) 
real ((2,4,4), (Ciel; |) (Gated; ((1,2,2), 
ty (0.8,.0.9,1))  (0.8,.0.9,1)) | (0.8,.0.9,1))  (0.8,.0.9,1)) 
secret ((2,2,3), ((-3,-2,-1), ((-2,-2,-1), ((1,2,3), 
(0.6,0.7,0.8))  (0.6,0.7,0.8)) | (0.6,0.7,0.8))  (0.6,0.7,0.8)) 
Table 9: Game matrix of defender and attacker type 2 in Example 4 
defender attacker type 2 
real ((5,5,6), ((-2,-2,-1), ((-2,-2,-1), ((1,2,3), 
ty (0.8,.0.9,1)) (0.8,.0.9,1)) (0.8,.0.9,1)) (0.8,.0.9,1)) 
secret ((5,6,6), ((-3,-2,-1), ((-4,-3,-2), ((1,2,3), 
(0.6,0.7,0.8))  (0.6,0.7,0.8)) | (0.6,0.7,0.8))  ,(0.6,0.7,0.8)) 
real ((4,4,5), ((-1,-0.5,0), ((-2,-1,-1), ((2,2,3), 
te (0.7,0.8,0.9))  (0.7,0.8,0.9)) | (0.7,0.8,0.9))  (0.7,0.8,0.9)) 
secret ((5,6,6), ((-2,-2,-1), ((-2,-2,-1), ((2,3,4), 
(0.6,0.7,0.8))  (0.6,0.7,0.8)) | (0.6,0.7,0.8))  (0.6,0.7,0.8)) 
real ((3,3,4), ((-3,-2,-2), ((-4,-3,-3), ((1,2,4), 
t3 (0.7,0.8,0.9))  (0.7,0.8,0.9)) | (0.7,0.8,0.9))  (0.7,0.8,0.9)) 
secret ((3,3,4), ((-1.5,-1,-0.5), ((-3,-2,-1), ((1,3,4), 
(0.6,0.7,0.8))  (0.6,0.7,0.8)) | (0.6,0.7,0.8))  (0.6,0.7,0.8)) 
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Table 10: Game matrix of defender and attacker type 1 as triangular fuzzy 
numbers in Example 4 


defender attacker type 1 

Cc u c u 
t, | real | (5.75,5.75,6.6)  (-2.8,-1.8,-1.8) (-2.8,-2.8,-1.9) (1.8,2.8,3.8) 
secret (2.5,2.5,3.3) (-1.6,-1.6,-0.8) (-3.3,-2.5,-1.67) (0.8,1.6,2.5) 

tz | real (5.3,5.3,6.2) (-1.78,-1.2,-0.8) (-4.4,-3.5,-2.6) (1.78,2.68,2.68) 

secret (3.3,4.1,4.1) (-1.6,-0.8,-0.8) (-1.67,-1.67,-0.8) (0.8,1.67,2.5) 
tz | real (1.8,3.8,3.8) (-1.2,-0.8,-0.8) (-2.8,-1.9,-0.9) (0.94,1.9,1.9) 
secret (1.6,1.6,2.5) (-2.5,-1.6,-0.8) | (-1.67,-1.67,-0.83) (0.8,1.67,2.5) 


Table 11: Game matrix of defender and attacker type 2 as triangular fuzzy 
numbers in Example 4 


defender attacker type 2 
c u c u 
t; | real (4.7,4.7,5.6)  (-1.7,-1.7,-0.8) | (-2.84,-1.89,-0.94) (0,1.89,2.84) 
secret (4.2,5,5) (-2.5,-1.6,-0.8) | (-1.67 ,-0.83,-0.83)  (0.83,1.67,2.5) 
tz | real (3.5,3.5,4.4) (-0.8,-0.4,0) (-1.7,-0.8,-0.8) (1.78,2.68,2.68) 
secret (4.1,4.1,5) (-1.7,-0.8,-0.8) | (-1.67,-1.67,-0.83)  (1.67,2.5,3.34) 
tz | real | ( 2.5,2.5,3.3)  (-2.6,-1.8,-1.8) | (-3.5,-2.68,-2.68) — (0.89,1.78,3.57) 
secret | (2.5,2.5,3.3)  (-1.2,-0.8,-0.4) (-2.5,-2.5,-1.67) (0.83,2.5,3.3) 


Now, for the given player’s payoffs, we calculate the ,/a values from (7), 
and apply them as the weights of payoffs. Then we have triangular fuzzy 
payoffs given in Tables 10 and 1. 

Solving the problem (Ps) by the weighted sum method (with equal weights 
for the objective functions) for these data yields the following solution: 


Creat = (0.52, 0.23, 0.04), Cscoret = (0, 0.83, 0.97). 


This means that the defender should allocate 52%, 23%, and 4% of his real 
forces to the targets 1, 2, and 3, respectively. Because of the constraint 
ec < m, not all resources will necessarily be allocated in the optimal 
solution. In this example, 79% of the real resources are used and 21% of 
them remain unused. Also, with the available budget, he can allocate 41.5% 
of the two secret forces (i.e., 0.83 of the two units) to the target 2 and 48.5% 
(i.e., 0.97 of the two units) to the target 3. 


Example 5. Consider the security game with two targets and three attackers 
solved in [7]. The players’ payoffs are given in Tables 12-14. 

Solving this example by our method (Problem P¢, without deceptive re- 
sources) yields the payoff 4.7 and the cover C = Crea = (0.05, 0.95). This 
example was solved in [7] with a pessimistic viewpoint and the defender’s 
payoff was obtained 3.19 and C = (0.29,0.79), which is not better than our 
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Table 12: Game matrix of defender and attacker type 1 in Example 5 


target 1 target 2 

cc U c UU 
defender | (3,5,6) — (-3,-2,-1) | (9,10,11) (2,3,5) 
attacker | (-2,-1,0)  (2,4,5) (-2,-1,0) (9,10,11) 


Table 13: Game matrix of defender and attacker type 2 in Example 5 


target 1 target 2 

c U c OU 
defender | (0,1,2) (0,0,0) | (1,2,4) — (-3,-2,-1) 
attacker | (-2,-1,0) (0,1,2) | (0,0,0) — (3,5,6) 


solution. Such a result was expected because the solution of [7] is a pessimistic 
solution. 


8 Conclusions 


Optimization of force allocation is an important issue in war situations for 
enemy points of attack, and in any situation (whether war or not), for sensi- 
tive centers and infrastructure. A motivated attacker monitors defense forces 
and takes advantage of the pattern of forces. Defenders must be able to pre- 
dict the attacker’s reaction to different defensive strategies with the highest 
probability. On the other hand, resource limitation is a major problem in 
many security areas. Game theory can be used as a valuable tool to analyze 
these issues and especially to determine the optimal strategy in case of a 
conflict of interests. Security games are used to solve various security issues 
according to the type and number of attackers and defenders. 

In this paper, a mathematical model was proposed to allocate defense 
forces in a security game with several attackers. Defenders can use deceptive 
resources to reduce attack, intensity, productivity, or costs. Applying these 
resources can fail with certain probabilities. Given these probabilities and 
budget constraints, a mathematical model was introduced to optimize the 
allocation of these deceptive resources. In the proposed model, the available 


Table 14: Game matrix of defender and attacker type 1 in Example 5 


target 1 target 2 

cc oU cc oU 
defender | (1,2,4) (-2,-1,0) (2,3,5) (-3,-2,-1) 
attacker | (-3,-2,-1) (0,1,2) | (-5,-3,-2) (2,4,5) 
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budget, the importance of targets for attackers and defenders, and their possi- 
ble strategies were considered to optimize the allocation of forces. Also, when 
the defender uses deceptive resources, the ambiguity in the amount of players’ 
payoffs for both players increases. Hence, the players’ payoffs were considered 
as Z-numbers. Then, the problem was solved in a two-stage procedure. In the 
first stage, the Z-numbers were converted to triangular fuzzy numbers, and 
in the second stage, the triangular fuzzy numbers were converted to intervals 
using their expected intervals. Then the interval programming problem was 
solved by an available method in the literature. Finally, the applicability of 
the proposed methods was illustrated by some numerical examples. 

There are various types of uncertain data, for example, intuitive fuzzy 
numbers, type-2 fuzzy numbers, and so on. The introduced model handles 
the payofts of real, triangular fuzzy numbers, and Z-numbers. However, it 
cannot be used for other types of fuzzy numbers (or types of uncertainty). 
As a suggestion, security games with multi-attacker can be solved with other 
kinds of uncertainty in payoffs. 
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